On a 3.99.15 domU, with 3.99.11 dom0,
tcpdump -n -i xennet0 not port ssh
worked fine.
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on xennet0, link-type EN10MB (Ethernet), capture size 96 bytes
19:40:54.587712 arp who-has [redacted].17 tell [redacted].1
[and many more]
--
Greg Troxel <gdt@ir.bbn.com>